{"slug":"csp-header-review","name":"CSP Header Review","version":"1.0.0","updated_at":"2026-10-26T21:00:39.147Z","use_when":"Reviews ONE Content-Security-Policy header, with any note pasted beside it, and lists only the gaps that let injected script run or let the page be framed, one line each with a fixed code, the directive, why it hurts and the fix - or exactly No findings. It catches unsafe-eval or unsafe-inline in the script directive, a star, a data source or a bare scheme as a script source, a policy with neither object-src nor a default-src, a missing base-uri, a missing frame-ancestors, and a report-only header that the note describes as blocking. It leaves out the safe look-alikes, such as unsafe-inline in style-src only, unsafe-inline beside a nonce, a nonce with strict-dynamic, and a data source for images. Use to review a CSP before rollout, to audit the headers of a site, or to check a policy copied from a tutorial.","not_for":"Cross-origin sharing, cookie attributes, meta-tag delivery, form-action, trusted types and report endpoints. It reads one pasted policy and judges only the directives written there; it cannot see the other headers of the response or what the page scripts do.","languages":["en"],"tags":["csp","content-security-policy","http-headers","xss","clickjacking","code-review"],"category":"code","category_url":"https://aiskills402.com/categories/code","keywords":["content-security-policy","unsafe-eval","frame-ancestors","report-only"],"faq":[{"q":"Style rules with inline styles allowed: a finding?","a":"No. The rule for unsafe words covers the script directive only, so inline styles in style-src get no line. An inline-script keyword that sits beside a nonce is also left alone, because the MDN page says such a list is ignored once strict-dynamic is present."},{"q":"Why is a star or a data source in the script directive reported?","a":"It is the skill's own rule. The MDN pages give no warning about those sources, so the skill states that, and lets every explicitly named host through, wildcard subdomains included."},{"q":"Which policies were used in the trial?","a":"A policy with an eval keyword and no framing rule, a report-only header that a ticket calls blocking and that lacks a base rule, and a strict nonce policy with nothing wrong. Both models, Sonnet and Haiku, ran every policy a single time."},{"q":"How is an all-clear reported?","a":"By the lone sentence No findings. and nothing else. A gap, by contrast, takes exactly one line: code, directive, reason, fix."}],"examples":[{"lang":"en","model":"claude-sonnet-5-5","input_excerpt":"Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'","output_excerpt":"SCRIPT-UNSAFE — script-src 'unsafe-eval' — eval() and similar string-to-code calls stay allowed, so injected text can be turned into running script — remove 'unsafe-eval' and refactor code that needs it, or use a nonce or hash with strict-dynamic…"}],"page_url":"https://aiskills402.com/skills/csp-header-review","markdown_url":"https://aiskills402.com/skills/csp-header-review.md","image_url":"https://cdn.aiskills402.com/og/skills/csp-header-review/07feb28f.png","related_url":"https://api.aiskills402.com/v1/skills/csp-header-review/related","purchases_count":null,"tested":{"date":"2026-10-26","strong":{"model":"claude-sonnet-5-5 (Claude Code alias \"sonnet\")","verdict":"Right on all 3 cases, read by hand. On the shop policy it found the eval keyword in the script directive and the missing framing rule, and left out the inline-style allowance and the data source for images. On the admin header it named the report-only header that the ticket calls blocking and the missing base rule, and left out the inline-script keyword that sits beside a nonce and strict-dynamic. On the strict policy it answered exactly No findings."},"weak":{"model":"claude-haiku-5-5 (Claude Code alias \"haiku\")","verdict":"Right on all 3 cases, read by hand. It matched the strong model on both planted headers, with the same fixes, and kept the safe look-alikes out. On the strict policy it answered exactly No findings. The fixes it proposes are sound; one even offers to correct the ticket instead of the header, which fits the facts."},"note":"Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike, and the headers carry no comment that points at the defect (the ticket sentence in the second case is the claim being checked, not a hint). Facts come from public MDN pages, read on 26 October 2026; the rule against a star or a data source as script source is our own. There are no owner-measured facts.","report_url":null},"price_usd":"0.01","price_micro":10000,"size_bytes":6190,"sha256":"bf9df88a1d4f9f18e673eaefa5963a9b442fbc90de226a42eb5f447ccdbfb025","outline":["What the MDN pages say, as published on 26 October 2026","The answer","The codes","Rules","Work in this order","Short example"],"license":{"summary":"Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing","holder":"Georgi Kalchev, aiskills402.com","url":"https://aiskills402.com/docs#license"},"buy_url":"https://api.aiskills402.com/v1/skills/csp-header-review/file","redownload_url_template":"https://api.aiskills402.com/v1/purchases/{token}","mcp_tool":null,"payment":{"protocol":"x402","scheme":"exact","asset":"USDC","selling":true,"network":"base","network_caip2":"eip155:8453","pay_to":"0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4","facilitator":"cdp"},"seo_title":"CSP Header Review for Script and Framing Gaps","seo_description":"Reviews one Content-Security-Policy header for unsafe script sources, missing base-uri and frame-ancestors, and report-only claims. Pay $0.01 once, in USDC.","versions":[{"version":"1.0.0","date":"2026-10-26","changelog":"# Changelog\n\n## 1.0.0 — 2026-10-26\n\nFirst release, written in the second light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from the public MDN pages (see notes/ideas.md). Output: see the skill description.\n\nTest: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.\n"}]}